Do I Need a Privacy Policy If I Only Have a Contact Form on My Website?

Section 6 of the Privacy Act 1988 (Cth) defines personal information as information or an opinion about an identified individual, or an individual who is reasonably identifiable. There is no minimum threshold.

A contact form asking for name, email address, phone number, and a message is collecting at least three pieces of personal information. The message itself may contain additional personal information depending on what the person writes — their address, health circumstances, or employment situation.

No. The APPs apply to how you collect, hold, use, and disclose personal information — not to the mechanism. A contact form, a booking page, a telephone call, a paper sign-in sheet, and a chat widget all constitute collection if they capture identifiable information about individuals.

The fact that a contact form is passive — the person volunteers the information — does not reduce your obligations. APP 3 governs the collection, APP 5 requires notification, and APP 11 requires security.

Four immediate obligations arise when someone submits your contact form:

1. Collection notice (APP 5) — at or before the point of collection, the person must be told the purpose and how you will handle the information. A brief sentence near the form is sufficient: "We collect your details to respond to your enquiry. See our privacy policy for more information."
2. Lawful and necessary collection (APP 3) — only collect what you need. Do not add contact form submissions to a marketing list without separate, specific consent.
3. Security (APP 11) — the submitted data must be held securely. If responses land in an email inbox, that inbox must be appropriately protected.
4. Access and correction rights (APPs 12–13) — the person who submitted the form has the right to access the information you hold and to request correction. Your privacy policy must explain how they can do this.

Potentially. If your contact form is powered by a third-party service — Typeform, JotForm, Gravity Forms, or Squarespace Forms — and submissions are stored on that provider's servers outside Australia, APP 8 may apply. Check where your form provider stores data and mention any overseas transfers in your privacy policy under the APP 1.4 overseas disclosure section.

Most popular form tools are US-based and store submissions on US servers. Even simple enquiry forms create APP 8 obligations if that is the case.

The purpose of your website does not change the collection obligations. An enquiry-only form still collects personal information, still triggers APP 5 notification requirements, and still requires a publicly available privacy policy under APP 1.

If you respond to the enquiry by email, that email thread is now personal information you hold — apply appropriate security and retention practices. APP 11 requires you to destroy or de-identify information you no longer need for a permitted purpose, so review and delete resolved enquiries after a reasonable period.